Extracted

• • Target

    48a57893c6e66b5e97510f08dcc0067d828c083ab1fc18a9b707f68b68f76b5e

  • Size

    570KB

  • MD5

    4429f833bcf6fe02be067211297b3915

  • SHA1

    ca98c318a073b62cab87cd9b8ebf72b3de6b2a07

  • SHA256

    48a57893c6e66b5e97510f08dcc0067d828c083ab1fc18a9b707f68b68f76b5e

  • SHA512

    ea47f7f2c1394f4428395695ff694cc650c4bc3789aeb594f8a3f6a7c39fb60b40b1b76114fab05faad619785e8cfbf99b91f188da4308089defbec30180cd9b

  • SSDEEP

    12288:5Mrfy90dahimz7AuxqVMRC46B72B4ho1O7q3ywTF:OyssVAuxYMIUB4hF7kTF

  Score

  10^/10

  redlinemangodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1